Capgemini-通过零信任协调加速您的零信任之旅英

Accelerateyourjourneytozerotrustwithzerotrustorchestration

Howtoorchestratesecure,reducedfrictionuser

journeyswithinaZeroTrustFramework

Customer-facingapplications

Forexample:

•Onlineretailwebsites

•Onlineandmobilebankingapps

•Customerportals

•Customersareexposedtoaccounttakeoversandidentitytheft

•Fraudandscamsleadtofinanciallossesandreputationaldamage

•Databreachesresultin

dataprivacyviolationsandregulatorypenalties

•Ransomwareattacksposeanexistentialthreatto

businessoperations

•Riskofintrusionanddatatheftbyhackersandfraudsters

•Potentialabuseofresourcesbyemployees

•Overlypermissionedusersdisruptsystems,eitherbyaccidentorbyintent.

Employee-facingapplications

Forexample:

•HRportals

•Filesystems

•Line-of-businessapps

INTRODUCTION

Cloudcomputingandinterconnectivityhave

changedITsecurityforever.Intheolddays,whenallyourserverslivedinyourowndatacentre

andeveryoneconnecteddirectlywithinyour

corporatenetwork,orviaVPN,youcouldrely

onyourcorporatefirewallasafixedperimeter

securitycontrol.Today,youremployees,partnersandcustomers—aswellasconnecteddevices

fromtheInternetofThings—couldbelogginginfromanylocation,viaanynetwork,toservices

hostedanywhere.

Keepingyourbusinesssafeinthesecomplex

hybrid,multi-cloud,hyper-connectedandhighly-

collaborativelandscapesisfarmorechallenging.

OrganisationsareincreasinglyrecognisingthattheonlywaytostaysecureinthisworldwhileprovidingafrictionlessuserexperienceisthroughaZero

Trustsecurityapproach,whichreplacesrelianceonlegacynetworksecuritycontrolswithanapproachwhereeveryaccessrequestisassessedonarich

contextualbasis.ThisZeroTrustArchitecturebecomesthenewperimeter.

ZeroTrustisnolongerjustabuzzword—it’snow

mandatedorrecommendedbygovernments

andindustrybodiesaroundtheworld.However,

weseethatasuccessfuladoptionofZeroTrust

principlessuchasthosedefinedinNIST-SP800-207

requirestheorchestrationofmultipleelements

thatcombinetoprovidepolicy-basedcontrolsthat

workacrossuserjourneysandchannels.Theseuser

journeysofteninvolvebothlegacyandmodern

systemsandservicesthatneedtoworktogether

seamlessly—andmanagingtheseinteractions

introducesnewproblems.

Thispaperexploresbestpracticesfororchestrating

theseinteroperatingelementsaspartofa

comprehensiveZeroTrustframework,addressing

thefollowingkeyquestions:

•WhatarethemarketchallengesthataredrivingorganisationstoimplementZeroTrust?

•WhatisaZeroTrustOrchestrationlayer,andwhyisitrequired?

•WheredoesanOrchestrationlayerdeliverthegreatestbenefits?

•HowareCapgeminiandPingIdentityhelpingorganisationsadoptZeroTrustOrchestration?

MARKETCHALLENGES

DRIVINGZEROTRUST

Wenowliveinaworldwhereemployeesexpecttobeabletoworkfromanywhereandlogintocorporateandpartnersystemsviaanydevice

onanyavailablenetworkconnection.The

challengefororganisationsistoopenupmorestreamlined,user-friendlyaccessforemployeesinthismodernenvironment,whilemaintaining

appropriatelevelsofsecuritytoprotectagainstincreasinglysophisticatedcyberthreats.

Meanwhile,customers(andregulators)are

increasinglyconcernedaboutdataprivacyand

theriskofidentitytheft,fraudandscams.

Customer-facingsystemswhichhavetraditionallybeendesignedtomaximiseuserconvenience

inasiloedwaymustnowfindwaystobolstersecurityandprotectcustomerdata,while

simultaneouslyimprovingtheuserexperience.

SecurityrisksUserexperiencerisks

•Complexregistrationprocess

discouragenewcustomersfromsigningup

•Difficultyloggingin

increasesriskofshoppingcartabandonment

•Personaldatausedinauthenticationraisesprivacyconcerns

•MutlipleloginsandlackofSSOresultinemployeeslockingthemselvesout

oftheirapplications,impactingproductivity

•Frequentlyre-enteringuserIDs,passwordsandOTPscreates

friction

Table1:DriversforZeroTrust

Balancingthecompetingdemandsofsecurityanduserexperienceforcustomersandemployeeshasbecomeincreasinglychallengingduetothelevelsofconnectivityandflexibilityrequiredbymodernuserjourneys.Aroutineuserjourney—suchas

acustomerorderingaproductoranemployee

creatingapurchaserequisition—nowoften

involvesinteractionsbetweendozensofservices,

fromlegacysystemshostedinthecompany’s

datacentretomicroservicesandthird-partySaaSapplicationsrunningacrossmultipleclouds.A

keydriverforaZeroTrustapproachisthatitcan

provideasolutiontothisdemandforbothsecurityanduserexperienceintoday’sopenenvironments,bytakingintoaccountthebroaderriskandcontextofthespecificaccessatanypointintime.

2|ZeroTrustOrchestration

ZeroTrustOrchestration|3

IDENTITY

DEVICES

NETWORKS

APPLICATION&

WORKLOADS

DATA

THEROLEOF

ZEROTRUST

ORCHESTRATION

AZeroTrustOrchestrationservicewithinaZero

TrustArchitectureprovidesapolicyandintegrationlayercapableofconnectingidentityelementsfrommanysystems,providingasinglepointofcontrol.

AnOrchestrationservicecancapturesignalsfromyourunderlyingapplicationsandinfrastructure

andpassthemtoacentralpolicyenginethat

drivessmart,real-timedecision-makingduring

complexuserjourneys.Andbest-practice

Orchestrationsolutions,suchasPingOneDaVinci,empoweryoutomapouttheseuserjourneysasseamlessflows,whiledefiningtheauthentication

andauthorisationrequirementsforeach

resourcebasedonappropriateriskmetrics.

AZeroTrustOrchestrationservicemakesitpossibletoimplementZeroTrustprinciples

quickly,effectively,andcost-efficiently—soyou

candesign,deployandevolveyouruserjourneys

seamlesslyinresponsetoemergingbusinessneeds.

VISIBILITYandANALYTICS

AUTOMATIONandORCHESTRATION

GOVERNANCE

WHYDOWENEED

ZEROTRUST

ORCHESTRATION?

Asdescribedabove,aZeroTrustapproachis

becomingtheonlyviablesolutionforeffectivelyprovidingaccessintheseextendedITecosystems.

However,implementingandmanaginga

comprehensiveZeroTrustframeworkcanbecomplex.

ThefundamentalprincipleoftheZeroTrustmodelisbasedontheassumptionofabreachandentailsameticulousexaminationofeachrequestasifit

wereoriginatingfromanentirelyuntrustedsource,suchastheunrestrictedinternet.Regardlessof

theoriginortheresourcebeingaccessed,theZeroTrustapproachmandatesa“nevertrust,always

verify”methodology.

Eachrequestmustprovidesufficientevidenceof

itslegitimacyasoriginatingfromanauthorized

userorapplication.Everyaccessrequestundergoescomprehensiveauthentication,authorization,

andencryptionbeforeandduringthesession.

Additionally,thelevelofverificationdeemed

“sufficient”mayvarydynamicallybasedoncontext,necessitatingadditionalsecuritymeasuresand/oraccessprivilegestobemodified.

EstablishingthecontextforZeroTrustverificationrequirestheorganisationtogatherinformation

fromanumberofdifferentsourceswhichare

potentiallyinterpretedbymutiplepolicyengines(or“signals”).AsZeroTrustimplementationsbecome

moresophisticatedandthenumberandtypeof

signalsincrease,aZeroTrustOrchestrationlayer

becomesvitaltointegratetheinformationfromall

thesesignals,makedynamicdecisionsonwhethertheaccessrequestalignswithsecuritypolicies,andtriggeranappropriateresponsefromthesecurity

toolingthatenforcesaccesscontrolacrossthe

technologystack.Itisthisabilitytotakesignals,

makesmartaccesscontroldecisionsbasedonthosesignalsandthenorchestratetheenforcementof

policythroughoutthetechnologystackthatformsthecoreofthetechnologyimplementationelementofaZeroTrustprogramme.

Figure2:ZeroTrustMaturityModelPillars,CISA

ZeroTrustMaturityModel,Version2.0,April2023.CISAdefineAutomationandOrchestrationasa

foundationalcross-cuttingcapabilityforZeroTrustArchitectures

4|ZeroTrustOrchestration

ZeroTrustOrchestration|5

Results

Accessdecisionsbasedonfully

orchestratedpoliciesactingon

comprehensivebest-of-breed

risksignals

ManagededgeZeroTrust

use-caseswiththebestvendors

forthetask

Deny

Approve

Policy-drivenOrchestration

Challenge

Obfuscate

ivani

Decisioning

Enforcement

6|ZeroTrustOrchestration

ZEROTRUST

ORCHESTRATION

USECASES

WenowseeZeroTrustOrchestrationasa

fundamentalcomponentwithinanyZeroTrustArchitecture.SomeusecaseswhereZeroTrustOrchestrationisparticularlybeneficialinclude:

Providingadaptivetrust

incomplexheterogeneous

environments

ZeroTrustOrchestrationcanhelpyougatherrisksignalsfromrightacrossyournetwork,including

variousriskandpolicyengines,andwidersecuritytoolingtofeedthemintoacentralOrchestrationpolicyenginethatcandeny,approve,logor

requestadditionalauthenticationforaccess

requestsatallrelevantstagesinyouruser

journeys.Moreover,aZeroTrustOrchestration

servicecanthenenableautomatedriskmitigationsbeyondAccessManagementsuchasfirewall

anddevicepatching,orremovalofaccessrightsthroughIGAintegration,proactivelypreventingincidentsandsavingtimeforyoursecurityteam.

Industry-leadingsolutionssuchasPingOne

DaVincialloworganisationstostreamlineand

simplifythisprocessbyincludingintegration

connectorstosecuritytoolslikeCrowdStrike,

OPSWAT,Splunk,InTune,JAMF,PingOneProtectandhundredsmore,alloutofthebox.

Providingadaptivetrustincomplexheterogeneousenvironments

DeviceUpdate

Available

SuspiciousOriginatingIPAddress

Suspicious

BrowserHistory

DeviceVulnerabilityDetected

Best-of-breedrisksignalsfrom

multiplevendorsources

Figure3:Feedbest-of-breedrisksignalsintoyourorchestrationpolicyengine

toensureappropriatedecisioning,enforcement,andremediation.

Rapiddevelopment

andintegration

Best-practiceZeroTrustOrchestrationservices

makeiteasytodevelopanddeploynewuser

journeysbyseamlesslyintegratingnewservicesandcomponentsintoauthenticationandauthorisationflows.Withalow-code,drag-and-dropinterface,

youcanquicklyextendyourZeroTrustlandscapetosecureadditionalsystemsandresources,andeasilyintroducenewidentity,securityandrisk

servicestogainevenrichercontexttoinformyourauthenticationandauthorisationpolicies.

Userjourneyoptimisation

ZeroTrustOrchestrationnotonlycreatesaunifiedpointofcontrolforyourZeroTrustarchitecture—

italsoprovidescentralisedvisibilityacross

youruserjourneys.ItenablesyoutointroducealternativeflowsandperformA/Btestingto

determineoptimalriskthresholds.Thisgives

theinsightneededtoaddorreducefriction

atappropriatestagesineachuserjourneyto

ensurepolicycomplianceandmaintainsecuritywhilealsodeliveringabetteruserexperience.

ZeroTrustOrchestration|7

Casestudy:Electricity

SystemsOperator

Capgeminihelpedamajornationalenergynetworkoperatorunifycustomerjourneysacrossavarietyofmodernandlegacyapplicationsformorethan

10,000userswithaZeroTrustsinglesign-on

(SSO)solution.UsingPingOneDaVinci,theteamorchestratedkeycustomerjourneysincluding

authentication,registration,socialloginand

self-service—simplifyingidentitymanagement,

strengtheningsecurity,improvinguserexperience,andsavingtimefortheITservicedesk.

Casestudy:PharmaceuticalCompany

Capgeminienabledalargemultinational

pharmaceuticalcompanytomoderniseitsdigitallandscapebycreatingaZeroTrustsecurity

frameworkformorethan20,000employeesacrossmorethan150globallocations.Thesolution

significantlyimprovestheuserexperienceandsimplifiesthetechnicalinfrastructure,aswellasoptimisingcapitalandoperationalexpenditureandstreamliningtheintegrationofnewmergersandacquisitions.

NEXTSTEPS

TolearnmoreabouthowCapgeminiandPingIdentitycanhelpyourorganisationembraceZeroTrustOrchestrationtoprovideyourcustomersandemployeeswithreducedfrictionuserexperiences,withoutcompromisingonsecurity,reachouttoustoday.

AUTHORS

AndrewCritchley

GlobalHeadofIAMCapability

Capgemini

Andrew.critchley@

RobOtto

FieldCTO/PrincipalSolutionsArchitect

PingIdentity

Robotto@

ZeroTrustOrchestration|9

TAKINGZEROTRUST

FROMTHEORY

TOPRACTICE

TomaketheshifttoaZeroTrustArchitecture,it

helpsifyoucancallontheexperts.CapgeminihasoneofthelargestIdentityandAccessManagement(IAM)practicesintheworld,withover1,000

consultantswhohavedeliveredmorethan200majorIAMprojectsinthelastfiveyearsalone.

Basedonitslong-establishedPingIdentitytrackrecordandnumberofcertifiedstaff,CapgeminiisalsoaPingDeliveryApprovedElitePartner.

AndCapgeminihasrecentlytransformedits

owninternalITsecuritymodeltoembraceZeroTrustprinciples,usingPingIdentityextensivelywithintheZeroTrustIdentitytowerandfor

IdentityOrchestration.

CapgeminiisnowprovidingIdentityandZeroTrustservicestoourclients,builtaroundfourkeypillars:

•Assess:measurethematurityofyour

organisation’sapproachtoimplementingZeroTrustinalignmentwiththeindustry-standardmaturitymodeldevelopedbyCISA.

•Advise:adviseonallelementsofZeroTrust,fromgovernance,operatingmodels,andprinciples

throughtoarchitectureanddesign–ZeroTrustisnotsimplyamatteroftechnology.

•Implement:workwithyoutoimplementsecureZeroTrustenvironments,governance,and

operationalservices.

•Operate:manageZeroTrusttechnologiesfromsecurelocationsacrosstheglobe,providingfullsecuritymonitoringandresponse24x7.

TogetherwithPingIdentity,CapgeminicanworkwithyoutohelpstartoraccelerateyourZeroTrustjourney–usingourknowledgeofallareasofZeroTrustincludingZeroTrustOrchestrationtomakethisareality.

8|ZeroTrustOrchestration

ZEROTRUST

ORCHESTRATION

SOLUTIONS–

PINGONEDAVINCI

HavingimplementedPingOneDaVinciwithmultiple

clients,CapgeminiseesPingOneDaVinciasabest-practicesolutionforZeroTrustOrchestration

inIdentity.AparticularstrongpointofPingOne

DaVinciisthatithasallowedustobuildidentityflowsusingitshighlyvisual,drag-and-drop

interface,withoutneedingtowriteasinglelineofcode.Thissimplifiesandacceleratestheprocessofcreating,updating,testinganddeployinguserjourneysthatoptimisesecuritywhileminimisingfrictionforend-users.

Furthermore,PingOneDaVinciiscompletely

vendor-agnosticandintegrateseasilywiththird-partyservices.ThismakesitparticularlysuitablefororganisationsthatwanttobuildaZeroTrustOrchestrationlayerontopoftheirexistinglegacyidentity